4.3 Explain Incident Relationships XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In XSOAR, where can an analyst view the relationships of an incident?

   • AIn the system logs, under 'Incident Links'
   • BIn the 'Global Settings' page, under 'Incident Connections'
   • CIn the incident details view, under the 'Relationships' section
   • DIn the 'Users' page, under 'Assigned Incidents'
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an incident review, an analyst notices that a phishing incident has a child incident for a user who clicked the malicious link. The analyst also sees a related incident for a different phishing campaign that used the same infrastructure. Which two relationship types are demonstrated in this scenario?

   • AParent-child and duplicate
   • BLinked and parent-child
   • CRelated and duplicate
   • DParent-child and related
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why do incident relationships matter in XSOAR?

   • AThey provide a way to see connections between incidents, which helps analysts identify patterns and respond more effectively
   • BThey allow incidents to be automatically resolved without analyst intervention
   • CThey reduce the storage space required for incident data
   • DThey are required for all incidents to be displayed in the Incidents page
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can an analyst remove an incident relationship in XSOAR?

   • ABy disabling the relationship feature in global settings
   • BBy deleting the incident from the system
   • CBy changing the incident type
   • DBy using the 'Unlink' option in the incident's relationships section
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How can automation be used to create incident relationships in XSOAR?

   • ABy scheduling a job that sends an email to the incident owner
   • BBy using a playbook that calls the 'LinkIncident' command
   • CBy writing a custom script that directly modifies the incident database
   • DBy configuring a firewall rule to link incidents
   Reveal Solution Discussion Select an answer first